org.apache.wicket.authorization
Interface IAuthorizationStrategy

All Known Implementing Classes:

AbstractPageAuthorizationStrategy, AbstractRoleAuthorizationStrategy, ActionAuthorizationStrategy, AnnotationsRoleAuthorizationStrategy, CompoundAuthorizationStrategy, MetaDataRoleAuthorizationStrategy, RoleAuthorizationStrategy, SimplePageAuthorizationStrategy

public interface IAuthorizationStrategy

Authorization strategies specify aspect-like constraints on significant actions taken by the framework in a given application. These constraints are guaranteed by the framework to be applied consistently throughout. Violations will result in a security action directed by the strategy, such as the throwing of an AuthorizationException or the filtering out of security-sensitive information.

Since:

Wicket 1.2

Author:

Eelco Hillenius, Jonathan Locke

Field Summary

static IAuthorizationStrategy

ALLOW_ALL Implementation of IAuthorizationStrategy that allows everything.

Method Summary

boolean	isActionAuthorized(Component component, Action action) Gets whether the given action is permitted.
boolean	isInstantiationAuthorized(java.lang.Class componentClass) Checks whether an instance of the given component class may be created.

Field Detail

ALLOW_ALL

static final IAuthorizationStrategy ALLOW_ALL

Implementation of IAuthorizationStrategy that allows everything.

Method Detail

isInstantiationAuthorized

boolean isInstantiationAuthorized(java.lang.Class componentClass)

Checks whether an instance of the given component class may be created. If this method returns false, the IUnauthorizedComponentInstantiationListener that is configured in the security settings will be called. The default implementation of that listener throws a UnauthorizedInstantiationException.

If you wish to implement a strategy that authenticates users which cannot access a given Page (or other Component), you can simply throw a RestartResponseAtInterceptPageException in your implementation of this method.

Parameters:

componentClass - The component class to check

Returns:

Whether the given component may be created

isActionAuthorized

boolean isActionAuthorized(Component component,
                           Action action)

Gets whether the given action is permitted. If it is, this method should return true. If it isn't, this method should either return false or - in case of a serious breach - throw a security exception. Returning is generally preferable over throwing an exception as that doesn't break the normal flow.

Parameters:

component - The component to be acted upon

action - The action to authorize on the component

Returns:

Whether the given action may be taken on the given component

Throws:

AuthorizationException - Can be thrown by implementation if action is unauthorized

See Also:

Component.ENABLE, Component.RENDER